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Listing of Claims: 

1 . (Previously Presented) A method for detecting a spoofed network 
connection[[s]] comprising: 

receiving a connection from a client; 

delaying sending a greeting message for a delay period, the delay period being 
less than or equal to a maximum tolerable delay, the maximum tolerable delay being the longest 
delay that would be tolerated by a valid client; 

monitoring the connection during the delay period; and 
if a command is received from the client before the greeting is sent, then 
identifying the connection as the spoofed connection. 

2. (Original) The method of claim 1 further comprising: 
sending the greeting to the client upon completion of the delay period. 

3. (Previously Presented) The method of claim 1 further comprising: 
processing any electronic mail associated with [[a]] the spoofed connection. 

4. (Previously Presented) The method of claim 3 wherein a spoofed- 
connection electronic-mail message is processed using a process selected from the group 
consisting of: 

deleting the spoofed-connection electronic-mail message; 

marking the spoofed-connection electronic-mail message; and 

storing the spoofed-connection electronic-mail message in an electronic directory. 

5. (Original) The method of claim 1 wherein the connection is a 
Transmission Control Protocol (TCP) connection. 

6. (Original) The method of claim 1 wherein the client is a Mail Transfer 
Agent (MTA) or Mail User Agent (MUA). 



Page 2 of 11 



BRUCE L. BROWN JR. et al. 

Application No. 10/742,329 

Reply to Office Action of April 1, 2008 



PATENT 



7. (Original) The method of claim 1 wherein the received command is a 
Simple Mail Transfer Protocol (SMTP) command. 

8. (Previously Presented) A method for detecting a spoofed network 
connection[[s]] comprising: 

receiving a first command at a server from a client; 

delaying, for a delay period, a transmission of a reply associated with the first 
command, the delay period being less than or equal to a maximum tolerable delay, the maximum 
tolerable delay being the longest delay that would be tolerated by a valid client; 

monitoring a connection between the server and the client during the delay period; 

and 

if a second command is received at the server before the reply is transmitted, then 
identifying the connection as the spoofed connection. 

9. (Original) The method of claim 8 further comprising: 

sending a greeting to the client when the connection is established with the server. 

10. (Original) The method of claim 8 further comprising: 
transmitting the reply upon completion of the delay period. 

1 1 . (Original) The method of claim 8 further comprising: 
processing any electronic mail associated with the spoofed connection. 

12. (Original) The method of claim 8 wherein the connection is a 
Transmission Control Protocol (TCP) connection. 

13. (Original) The method of claim 8 wherein the client is a Mail Transfer 
Agent (MTA) or Mail User Agent (MUA). 

1 4. (Original) The method of claim 8 wherein the received command is a 
Simple Mail Transfer Protocol (SMTP) command. 



Page 3 of 11 



BRUCE L. BROWN JR. et al. PATENT 

Application No. 10/742,329 

Reply to Office Action of April 1, 2008 

15. (Previously Presented) An apparatus for detecting a spoofed 
connection[[s]] comprising: 

means for detecting when a connection is established between the apparatus and a 

client device; 

means for transmitting a greeting message or a reply or both to the client device; 

means for delaying the transmitting means so that the greeting message or the 
reply or both are not transmitted during a delay period, the delay period being less than or equal 
to a maximum tolerable delay, the maximum tolerable delay being the longest delay that would 
be tolerated by a valid client; and 

means for monitoring the connection to detect commands that are sent by the 
client device at least during the delay period. 

1 6. (Original) The apparatus of claim 1 5 wherein the client device is a Mail 
Transfer Agent (MTA) or Mail User Agent (MUA). 

17. (Original) The apparatus of claim 1 5 wherein the detecting means, the 
transmitting means, the delaying means, and the monitoring means comprise one or more 
processor-based devices running software algorithms to provide the detecting, transmitting, 
delaying and monitoring functions. 

18. (Original) The apparatus of claim 1 5 wherein the connection is a 
Transmission Control Protocol (TCP) connection. 

19. (Original) The apparatus of claim 15 wherein the commands are Simple 
Mail Transfer Protocol (SMTP) commands. 
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